An authorization bypass vulnerability in Snipe-IT versions 8.6.1 and earlier allows authenticated users with report viewing permissions to manipulate checkout-acceptance records across different companies.

This vulnerability is an authorization bypass (CWE-639) triggered by a flawed null check on the company_id column. Authenticated users with the reports.view capability can enumerate sequential acceptance IDs to soft-delete or trigger reminder emails for records belonging to other companies.

The exploitation of this flaw allows for unauthorized modification of sensitive asset management data, specifically checkout acceptances. Given the CVSS score of 8.5, this high-severity issue poses a significant risk to data integrity and organizational privacy, as it effectively breaks the logical separation between companies in a multi-tenant environment.

Immediate Action: Upgrade to Snipe-IT version 8.6.2 or later, which includes the necessary fix to the affected checkout-acceptance report logic.

Proactive Monitoring: Review audit logs for unusual patterns of report access or unexpected modifications to checkout-acceptance records, particularly those originating from user accounts with standard report-viewing privileges.

Compensating Controls: If immediate patching is not feasible, restrict the reports.view permission to the minimum number of users necessary and monitor for high volumes of sequential requests to the acceptance report endpoint.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant breakdown in access control within the Snipe-IT platform. Administrators should prioritize the update to version 8.6.2 to ensure that company data isolation is restored. Given the existence of a proof-of-concept, prompt remediation is essential to prevent potential data integrity incidents within multi-company deployments.